Cyber Operation and Penetration Testing Scanning Cliff Zou University of Central Florida

1. Cyber Operation and Penetration TestingScanningCliff ZouUniversity of Central Florida

2. Acknowledgement • Content from the book: “The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy”, Second Edition

3. Acknowledgement • Presentation slides: “Using Nessus and Nmap to Audit Large Networks” By Greg Johnson, Principal Security Analyst University of Missouri – Columbia • https://www.cs.uaf.edu/2003/fall/cs493/refs/JohnsonAudit.ppt

4. Checking Machine Online Status? • root@kali: ping IPaddress • Windows with firewall enabled blocks PING by default for not home network (subnet) • Enable PING response in Windows: • Search “firewall”, click “Windows Firewall” in control panel • Click “Advanced settings” on the left • From the left panel, click “Inbound Rules” • Find the rules titled “File and Printer Sharing (Echo Request - ICMPv4-In)” • Right-click each rule and choose “Enable Rule”.

5. Ping and Ping Sweep • Ping Sweep: series of pings sent to a range of IP addresses • Tool: fping (preinstalled in Kali Linux) • fping -a -r 0 -g 192.168.0.1 192.168.0.254 • -a: only show live • -r 0: retry ping number (0 means only 1 ping per IP) • -g: the IP range • Con: only can find computers that respond to ICMP echo request message

6. Port Scanning • Discover what services are running on a target computer • See the “common port number” sheet: http://packetlife.net/media/library/23/common_ports.pdf

7. Pre-Knowledge: Network Layered Structure • What is the Internet? Web, Email, VOIP Application Application TCP, UDP Transport Transport IP Network Network Ethernet, cellular Data Link Data Link Physical link

8. 32 bits source port # dest port # sequence number acknowledgement number head len not used Receive window U A P R S F checksum Urg data pnter Options (variable length) application data (variable length) Pre-Knowledge: TCP segment structure URG: urgent data (generally not used) counting by bytes of data (not segments!) ACK: ACK # valid # bytes rcvr willing to accept PSH: push data now RST, SYN, FIN: connection estab (setup, teardown commands) Internet checksum (as in UDP)

9. TCP Connection Setup --- Three-Way Handshaking Step 1:client host sends TCP SYN segment to server • specifies initial seq # • no data Step 2:server host receives SYN, replies with SYN/ACK segment • server allocates buffers • specifies server initial seq. # Step 3: client receives SYN/ACK, replies with ACK segment, which may contain data client server SYN, seq=client_seq SYN/ACK, seq=server_seq, ack=client_seq+1 ACK, seq=client_seq+1 ack=server_seq+1 Transport Layer

10. Closing a connection: close(); Step 1:client end system sends TCP/FIN control segment to server Step 2:server receives FIN, replies with ACK. Closes connection, sends FIN. client server close FIN ACK close FIN ACK timed wait closed TCP Connection Management (cont.) Transport Layer

11. Step 3:client receives FIN, replies with ACK. Enters “timed wait” - will respond with ACK to received FINs Step 4:server, receives ACK. Connection closed. TCP Connection Management (cont.) client server closing FIN ACK closing FIN ACK Some applications simply send RST to terminate TCP connections immediately timed wait closed closed Transport Layer

12. Private IP subnets used in NAT • 10.0.0.0/8 • UCF using this large subnet • Many global IPs  this 224 IP space • 192.168.0.0/16 • Home WiFi and Wifi hotspot use this subnet • Home Wifi uses 192.168.0.0/24, or 192.168.1.0/24 • Single global IP  this 256 IP space • 172.16.0.0/12 • Not widely used

13. TCP based Scan • TCP connect scan • Open port: syn/ack response • Closed port: rst/ack response • TCP syn scan (half-open scan) • TCP fin scan • TCP null scan (no flag is set) • TCP ack scan • TCP XMAS tree scan (all flags are set)

14. Background: Port Status A port can be: • Closed (not in use), • Open (listening), or • Filtered (the client computer asked for open or closed status report, and the target computer did not reply, usually due to a firewall.)

15. Port Scanning Tool: Nmap • Included in Kali Linux • nmap –sT 192.168.0.101 • Default scan will scan 1000 TCP ports • For safety, try nmap on your own VMs in the same LAN, such as the Metasploitable VM

16. Nmap Command Options • -sT: TCP connect scan • -sS: TCP SYN scan • -sA: TCP ACK scan • -sF: TCP FIN scan • -sX: XMAS tree scan • -sN: NULL scan • -sP: Ping scan • -sU: UDP scan • -sO: protocol scan • A good online tutorial: • https://hackertarget.com/nmap-cheatsheet-a-quick-reference-guide/

17. Nmap Target Selection • Scan a single IP • nmap 192.168.1.1 • Scan a host • nmap www.testhostname.com • Scan a range of IPs • nmap 192.168.1.1-20 • Scan a subnet • nmap 192.168.1.0/24 • Scan targets from a text file • nmap -iL list-of-ips.txt (one IP per line)

18. Nmap Port Selection • Scan a single Port • nmap -p 22 192.168.1.1 • Scan a range of ports • nmap -p 1-100 192.168.1.1 • Scan 100 most common ports (Fast) • nmap -F 192.168.1.1 • Scan all 65535 ports • nmap -p- 192.168.1.1 • Be careful with this. Generate large amount of scanning traffic!

19. Nmap Port Scan Types • Scan using TCP connect • nmap -sT 192.168.1.1 • Scan using TCP SYN scan (default) • nmap -sS 192.168.1.1 • Scan UDP ports • nmap -sU-p 123,161,162 192.168.1.1 • Scan selected ports - ignore discovery • nmap -Pn -F 192.168.1.1

20. What NMAP Does Not Do NMAP does not determine what program is running at an open port! Whatever service NMAP reports—http, ftp, smtp, etc.—is an assumption based on standards. Hacker trick: disguise a remote control access with the port number normally used by domain name service (53), web service (80), etc. especially if firewalls pass traffic on these ports.

21. Service and OS Detection • Detect OS and Services • nmap -A 192.168.1.1 • Will setup connection successfully and get the first data packet from the server • Standard service detection • nmap -sV 192.168.1.1 • More aggressive Service Detection • nmap -sV --version-intensity 5 192.168.1.1 • Lighter banner grabbing detection • nmap -sV --version-intensity 0 192.168.1.1

22. Service and OS Detection • The more aggressive service detection is often helpful if there are services running on unusual ports. • The lighter version of the service will be much faster as it does not really attempt to detect the service by simply grabbing the banner of the open service.

23. Nmap Script Engine (NSE) • Nmap --script banner 192.168.0.101 • Setup TCP connection, get the first response text from the target • Nmap --script vuln 192.168.0.101 • Run a series of scripts looking for known vulnerabilities

24. GUI-based Nmap: Zenmap • Included in Kali Linux • Where? • Application menu  “Information Gathering…”  Zenmap • You can download Zenmap for Windows and Mac OS as well • https://nmap.org/zenmap/

25. Nessus: a GUI-based Power Network Scanner • Nessus is a proprietary vulnerability scanner which is developed by Tenable Network Security. It is free of charge for personal use in a non-enterprise environment ----wikipiedia.com • Download home-only FREE version: http://www.tenable.com/products/nessus/select-your-operating-system • Request a home-only registration key: http://www.tenable.com/products/nessus-home • Tutorial on installing nessus on Kali Linux • http://www.tenable.com/blog/installing-and-using-nessus-on-kali-linux

26. Install Nessus on Kali Linux • Download the free home version of nessus for Linux: • Debian 6 and 7 / Kali Linux 1 AMD64 (64bit VM) • File: Nessus-6.5.6-debian6_amd64.deb • Debian 6 and 7 / Kali Linux 1 i386 (32-bit VM) • File: Nessus-6.5.6-debian6_i386.deb

27. Install Nessus on Kali Linux • #dpkg –iNessus-6.5.6-debian6_amd64.deb • For programs existed in Kali’s App store, use “apt-get install …” to install them • Enable nessus service first: • #/etc/init.d/nessusd start • Then the nessus demon will start to run • Nessus relies on Web Browser for GUI and remote access • Local access: https://localhost:8834/ • Remote access: https://192.168.0.3:8834/ (if the machine running nessusd has IP of 192.168.0.3)

28. Web Browser-based GUI and Remote Access • Many recent software use this way for implementation • Pros: • A user can remote access and use the software • Remote user does not need any client-side software installation • Cons: • Rely on the graphic and interaction functions provided by Browsers, may not be beautiful • Could suffer the same Web-based attacks

29. Use of Nessus • Why Nessus runs as a webserver (on port 8834)? • It enables other computers to do nessus scanning, too, by remote login to the Nessus server machine • You can install Nessus server on Linux, or Windows • Nice video tutorial on using Nessus: • https://www.youtube.com/watch?v=r_pDVhNoYr0

30. Use of Nessus • Assume the Nessus is installed in Kali VM • We run Nessus on the Win7 VM in the same LAN • The warning is normal Due to the Nessus Server has no valid Digital certificate

31. Use of Nessus • First run, set up an account as you choose the username and password

32. Use of Nessus • First run, after account set up, you need to input your activation code:

33. Use of Nessus

34. Use of Nessus • The free version comes with a few predefined types of scans • The gray entries are only available in commercial version

35. Use of Nessus • Test of Basic Network Scan: • You can test to scan your Kali VM, Win7 VM, • The best target is the Metasploitable VM since it has many vulnerabilities that can be discovered by Nessus

36. Metasploitable 2 Virtual Machine • Use nmap to see what services are running on this Linux • Use Nessus installed on your Kali Linux to check any known vulnerabilities on this Linux

37. Is Scanning Dangerous? Both NMAP and NESSUS aim to never damage data. In MU’s NMAP and NESSUS scanning of 13,000 connections in its network, no data has ever been lost through scanning.

38. Is Scanning Dangerous? HOWEVER! • NMAP and especially NESSUS can freeze scanning targets. The network application may freeze. The entire system may require restarting. Some devices such as printers or routers may reset themselves—or not.

39. Is Scanning Dangerous? • In MU’s scanning, freezes are rare: about one in six hundred general purpose systems for tests that are not explicitly dangerous. • NESSUS designates about 10% of its tests as dangerous, denial of service attacks such as oversize data or flooding. In tests of 200 diverse systems, around one third eventually fell to a denial of service attack.

40. Is Scanning Dangerous? A full 65,535 TCP port scan and service check generates • at least 5 MB of traffic to the target • and at least 6 MB in reply. • Most of this traffic is small packets. Hence…

41. Is Scanning Dangerous? • Typical testing over a 10 or 100 Mbps connection will noticeably but not painfully slow target system performance for around 15 minutes. • Scanning multiple targets through one network device can slow that subnet’s performance. • NMAP and NESSUS offer options to scan slowly or aggressively, and to randomize target sequence.

42. Safe Scans • Hence, scan critical infrastructure systems with someone ready to restart systems. Performance monitoring may yield insights. • For extra safety, move NESSUS denial of service tests out of their normal directory.